up vote 3 down vote favorite
share [g+] share [fb]

On most computers we can press a key, in my case F12, to access the boot menu where we can choose to boot from another drive, such as the CD or another HD.

I want to eliminate that possibility or ask to be asked a password when I tried to boot a computer that way.

I do not want the computer to ask a password when it boots normally to Windows, but only if someone tries to access the boot menu.

Thank you.

link|improve this question
100% accept rate
feedback

7 Answers

up vote 13 down vote accepted
+100

You can try assigning a BIOS / administration password as the boot menu may be covered by that, however, if this doesn't work and you do not want a boot password, I do not think there will be any way to achieve what you want.

link|improve this answer
2  
BIOS admin password or nothing... ;) Sorry – Jakub Dec 10 '09 at 16:21
If you set a BIOS password and that doesn't protect the boot menu, you can normally set the boot order to only allow your main hard drive. This is of course dependent on the motherboard and what options are allowed. This would only protect against idle attempts to boot alternate media. If the computer is stolen, this measure is easily defeated. All you have to do is use the reset CMOS jumper or remove the battery. Something that take 10 seconds once you gain access to the inside of the machine. – Doltknuckle Dec 10 '09 at 23:12
No matter the boot order I choose on the BIOS, that can easily be circumvented by pressing F12 right after POST. – elvispt Dec 10 '09 at 23:33
@Doltknuckle, @elvispt, as I said, this would be the only way to do it - If the BIOS doesn't support password protecting it, you are out of luck.... Unless you want to download a BIOS update and hex edit it to get rid of the boot menu all together.... but I wouldn't recommend it! – William Hilsum Dec 11 '09 at 7:34
1  
@pipTheGeek, that is pretty much what I wrote - but again, as I said, password on boot menu is BIOS dependent. – William Hilsum Dec 15 '09 at 18:31
show 2 more comments
feedback
up vote 4 down vote

But Bios password doesn't improve security much. If you need to protect your hard drive from access from another Os only secure option is disk encryption (for full security it should be combined with TPM),

link|improve this answer
1  
i'm not sure that's his goal, but you're right about the security picture here. – quack quixote Dec 10 '09 at 16:51
Indeed it's not my goal. If I wanted total security I would just put a password so that nobody would access the computer, but I just want to prevent access to the boot menu or password protect it. – elvispt Dec 10 '09 at 18:40
Encrypting the hard disk without also protecting the BIOS doesn't work. A recently-published exploit shows that an attacker can install a keylogger even if they can't decrypt the hard drive. The keylogger then steals the password for the drive. It's the "Evil Maid" exploit if you want to search for it. – CarlF Dec 15 '09 at 4:20
BIOS password wouldn't protect against it. Attacker can remove hard drive and install key logger. Please read Joana's Rutkowska article again. Only "good enough" protection against that attack is TPM (it's not 100% bullet prof but TPM hacking required expensive laboratory hardware). – Maciek Sawicki Dec 15 '09 at 10:40
feedback
up vote 1 down vote

On one of my machines, the BIOS boot password is not effective until I change TWO settings:

1. Set an administrator password
2. Set something like "BIOS changes require Password" to "Boot requires Password"

Sorry for not having the correct wording, I am not in front of the BIOS (obviously). This accomplishes BIOS Then F12 or other buttons do not work any more. Of course the bios-reset jumper still applies...

link|improve this answer
feedback
up vote 0 down vote

Windows bootloader does not support password protection at all. You'll have to install GRUB bootloader in order to have this feature.

link|improve this answer
Wouldn't accomplish what I'm after. :) – elvispt Dec 15 '09 at 15:21
feedback
up vote 0 down vote

If you want to protect the system from attackers, physical security is your best bet. Put a physical lock on the case like the old IBM systems, and the attacker would have to open the system and switch cables to do anything.

link|improve this answer
Not an option. Thanks anyway. :) – elvispt Dec 15 '09 at 15:21
feedback
up vote 0 down vote

Very low tech, not ideal, circumventable, but possibly very effective for a typical user and most applications: Physically render the F12 key on the keyboard non-functional. Pop open the keyboard and sever the connection that key has or otherwise interfere with the contact while allowing normal motion. F12 isn't exactly a commonly used key.

link|improve this answer
what an ugly hack... i like it. it might do the trick. but getting around it is just as low-tech: plug in a different (non-hacked) keyboard. – quack quixote Dec 18 '09 at 5:25
feedback
up vote 0 down vote

simply put, this cannot be done.

unless, of course, you find a BIOS editor compatible with your BIOS and brace yourself for the chance of bricking it.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.